United Nations 


S/2017/904 



^ Security Council 


Distr.: General 
26 October 2017 


Original: English 


Letter dated 26 October 2017 from the Secretary-General 
addressed to the President of the Security Council 

I have the honour to convey herewith the seventh report of the Organisation 
for the Prohibition of Chemical Weapons-United Nations Joint Investigative 
Mechanism (see annex). 

I should be grateful if the present letter and its annex could be brought to the 
attention of the members of the Security Council. 


( Signed) Antonio Guterres 


IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII^ 


17-18978 (E) 011117 


Please recycle 





S/2017/904 


Annex 


Letter dated 26 October 2017 from the Leadership Panel of the 
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Organisation for the Prohibition of Chemical 
Weapons-United Nations Joint Investigative Mechanism 
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Enclosure 


Seventh report of the Organisation for the Prohibition of Chemical 
Weapons-United Nations Joint Investigative Mechanism 

I. Introduction 

1. The seventh report of the Organisation for the Prohibition of Chemical 
Weapons (OPCW)-United Nations Joint Investigative Mechanism is submitted 
pursuant to Security Council resolutions 2235 (2015) and 2319 (2016). It covers the 
period from 23 June 2017, when the sixth report of the Mechanism (see S/2017/552) 
was submitted to the Council, to 25 October 2017. 

II. Background 

2. As set forth in resolutions 2235 (2015) and 2319 (2016), the mandate of the 
Mechanism is to identify, to the greatest extent feasible, individuals, entities, groups 
or Governments who were perpetrators, organizers, sponsors or otherwise involved 
in the use of chemicals as weapons, including chlorine or any other toxic chemical, 
in the Syrian Arab Republic where the OPCW Fact-Finding Mission in the Syrian 
Arab Republic determines or has determined that a specific incident in that country 
involved or likely involved the use of chemicals as weapons, including chlorine or 
any other toxic chemical. In accordance with resolution 2319 (2016), the mandate of 
the Mechanism will come to an end on 16 November 2017. 

3. The Mechanism consists of an independent three-member panel together with 
a core staff of professionals selected on the basis of their expertise, taking into 
account geographical diversity and the equal participation of women and men. The 
Mechanism is headed by an Assistant Secretary-General, Edmond Mulet, with 
overall responsibility, and two deputies with responsibilities for investigative and 
political matters, respectively. Those three positions constitute the Leadership Panel 
of the Mechanism. 

4. The Head of the Mechanism has continued to be supported by three 
components: the Investigative Office, the Political Office and the Planning and 
Operations Support Office. The Investigative Office is based in The Hague, 
Netherlands, and comprises two units: the Information Collection Unit and the 
Analysis and Corroboration Unit. The Political Office is based in New York, with a 
liaison officer in Damascus, and provides, inter alia, political analysis, legal advice, 
liaison, and media and information management support. The Planning and 
Operations Support Office is based in New York and provides administrative, 
logistical and planning support to the political and investigative components. 

5. While the OPCW Fact-Finding Mission in the Syrian Arab Republic works to 
establish the facts surrounding allegations of the use of toxic chemicals for hostile 
purposes in the country, it is not mandated to reach conclusions about attributing 
responsibility for chemical weapons use. 1 Following a determination by the Fact- 
Finding Mission that a specific incident in the Syrian Arab Republic involved or 
likely involved the use of chemicals as weapons, the Mechanism conducts an 
investigation to identify, to the greatest extent feasible, the perpetrators, organizers, 
sponsors or those otherwise involved. In conducting its investigation, the 
Mechanism relies on findings of the Fact-Finding Mission regarding the use of 
chemicals as weapons in each incident and pursues a rigorous independent 


1 See S/2014/533, para. 14, and resolution 2235 (2015), eighth preambular para. 
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examination of the available information surrounding such use so as to identify, to 
the greatest extent feasible, those responsible. 

6. As indicated in the sixth report of the Mechanism, the position of the 
Leadership Panel remains that, if new information is provided regarding the four 
cases initially referred to in the third and fourth reports of the Mechanism 
(see S/2016/738/Rev. 1 and S/2016/888), supplementary investigations may be 
undertaken. For the present report, the Mechanism focused on incidents that had 
occurred at Umm Hawsh on 15 and 16 September 2016 and at Khan Shaykhun on 
4 April 2017. 

III. Methods of work 

7. The Mechanism is committed to the principles of impartiality, objectivity and 
independence in carrying out its work. The Mechanism continued to implement its 
mandate in accordance with the methods of work outlined in its previous reports, 
including in annex I to its third report (see S/2016/738/Rev.l). There are two main 
phases of the work of the Mechanism. During the first phase (information collection 
and planning for case development), the Mechanism reviews and analyses data, 
collects relevant information and creates a preliminary investigation plan. Following 
a decision by the Leadership Panel to conduct an in-depth investigation into a 
particular incident, the Mechanism requests full access to the information obtained 
or prepared by the Fact-Finding Mission. 

8. The second phase (case investigation) commences thereafter, beginning with 
the preparation of an in-depth investigation plan, which includes the consideration 
of possible scenarios. During this phase, the Mechanism conducts detailed analysis 
of the information obtained by the Fact-Finding Mission and collects additional 
information from other sources, including its field missions. This work continues 
until the Mechanism is satisfied that it has gathered and assessed all of the 
information and evidence that it can reasonably obtain and, on that basis, presents 
its findings to the Security Council. 

9. As an investigative mechanism without judicial powers, the Mechanism cannot 
compel the submission of information or documents to it, but relies on the voluntary 
cooperation of witnesses and those in possession of relevant information. In 
obtaining information and conducting analysis and assessment thereof, the 
Mechanism complied with the relevant terms of reference approved by the Security 
Council (see S/2015/669 and S/2015/697) and carried out its work in an independent 
and impartial manner. At all times, it was guided by the highest professional 
standards. 

10. In preparing the investigation plan for each case, the Mechanism outlined a 
series of possible scenarios, including those put forward by Member States, based 
on all available information as to how the incidents might have occurred. 

11. In conducting its investigations into the incidents at Umm Hawsh and Khan 
Shaykhun, the Mechanism undertook the following key activities: (a) obtaining and 
reviewing information and material from the Fact-Finding Mission; (b) collecting 
information from open sources; (c) submitting requests to Member States, including 
the Syrian Arab Republic, for information; (d) interviewing witnesses, including 
during visits to the Syrian Arab Republic, and obtaining photographs, videos, 
documents and other materials; (e) obtaining analysis and expert assessments from 
several forensic institutes; (f) obtaining satellite imagery and analysis thereof; 
(g) obtaining expert analysis in respect of medical effects, munitions and their 
delivery methods, aircraft configurations and capabilities, plume dispersion, and 
chemistry of toxic agents; (h) obtaining information about weather conditions; and 
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(i) attending expert briefings. Upon obtaining the above-mentioned information, the 
Mechanism conducted extensive analysis of the information and material that it had 
obtained. 

12. With a view to identifying those responsible, the investigation was aimed at 
establishing, to the greatest extent feasible, the circumstances of the use of the 
chemical weapons, including in respect of the following: (a) the precise date and 
time of the incident; (b) the impact location; (c) the munition used; (d) the munition 
delivery method; and (e) the medical effects and response. In collecting and 
analysing the information relating the incidents, the Mechanism prepared a case file 
for each incident, documenting the information collected and the analysis performed 
in respect of each scenario. 

13. Following an invitation by the Syrian Arab Republic to the Head of the 
Mechanism on 28 July 2017, and the Government’s agreement that the Mechanism’s 
liaison officer should take up his duties in Damascus, members of the Mechanism 
made several visits to the Syrian Arab Republic in support of the investigation. The 
Head of the Mechanism visited Damascus from 19 to 21 August, and the 
Mechanism’s technical teams visited Damascus from 7 to 11 September and Sha‘irat 
airbase from 8 to 10 October. Throughout its mandate, the Mechanism worked 
actively to obtain information from Member States, international and 
non-governmental organizations, individuals and other relevant entities. 

14. The Mechanism did not visit the scenes of the incidents at Umm Hawsh and 
Khan Shaykhun. While the Leadership Panel considered that visits to those sites 
would have been of value, such value would diminish over time. Furthermore, the 
Panel was required to weigh the security risks of such visits against their possible 
benefits for the investigation. 

15. With respect to Khan Shaykhun, the crater from which the sarin emanated had 
been disturbed after the incident and subsequently filled with concrete. Accordingly, 
the integrity of the scene had been compromised. The Leadership Panel considered 
that the high security risk of a site visit to Khan Shaykhun, which is currently in a 
situation of armed conflict and under the control of a listed terrorist organization 
(Nusrah Front), outweighed the possible benefits for the investigation. The 
Leadership Panel decided to keep the issue under review. Should conditions 
improve, and should it be determined that an on-site investigation would produce 
valuable new information, a visit could take place in the future. In that context, the 
Mechanism recently received an updated security advisory noting changes in the 
extent of the control exerted by various groups and additional parties involved, 
including increased complexity involving indirect artillery fire and recurrent air 
strikes. 

16. Similarly, in the case of Umm Hawsh, the passage of time between the 
occurrence of the event in mid-September 2016 and the commencement of the 
Mechanism’s investigation on 25 May 2017, and the fact that the integrity of the 
scene of the incident had not been preserved, called into question the value of such 
a visit. Moreover, in the light of the extensive information that the Mechanism had 
been able to obtain from witnesses, an on-site visit would have provided little 
additional value. 

17. The Mechanism also noted that it would have been difficult to visit any of 
these sites without putting at risk persons who cooperated with it. Nevertheless, the 
Leadership Panel considered that the Mechanism had gathered sufficient 
information to come to a conclusion in both cases. 
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times, in addition to those interviewed by the Fact-Finding Mission. Regarding 
Umm Hawsh, these included victims of the attack, journalists who had been present 
in the immediate aftermath of the attack, doctors who had treated victims, and 
military commanders. Regarding the incident at Khan Shaykhun, witnesses included 
residents, personnel from Sha‘irat airbase, government officials, doctors who had 
treated victims, rescue personnel and commanders of non-State armed groups. 

19. The Mechanism obtained information regarding the physical characteristics of 
the sites through satellite imagery taken both before and after the incidents, the 
analysis of which assisted the Mechanism in determining the timing and precise 
location of the events being investigated. Moreover, the Mechanism collected 
numerous photographs and videos relating to the incidents both directly from 
witnesses and from other sources, including the Syrian Arab Republic. Those 
images and videos depict impact locations; impact effects, such as plumes and 
building damage; casualties; and munition remnants. The Mechanism obtained 
forensic analysis of more than 250 videos and photographs, including to determine 
their authenticity and the times and places at which they had been taken. 

20. Given that a significant amount of the information collected by the Mechanism 
was available only in Arabic, including a large volume of medical records, 
interviews, logbooks and videos (more than 435 files), the Mechanism employed its 
own translators and established quality control measures in order to translate the 
materials into English so that they could be used by its investigators. 

21. The Mechanism corroborated information considered important to its 
investigations and made assessments only on the basis of credible and reliable 
information. In that regard, identifying circular reporting was important in order to 
ensure that the corroboration was based on independent sources of information. 

22. The Mechanism engaged several internationally recognized forensic and 
specialist defence institutes as well as OPCW-designated laboratories, considered to 
have established expertise and a record of outstanding performance, to provide 
forensic and expert support for the investigation. The forensic institutes and OPCW - 
designated laboratories are accredited in accordance with the International 
Organization for Standardization standard relating to a broad spectrum of lab oratory 
work (ISO 17025). They were engaged by the Mechanism to authenticate 
photographs and video footage; to verify the times and places at which the 
photographs and footage had been taken; and to provide independent expert 
assessments and simulations with respect to items depicted, as well as chemical 
synthesis and analysis. The Mechanism also consulted with several internationally 
recognized experts in energetic materials and the medical effects of chemical 
warfare agents. 

23. With regard to Umm Hawsh, expert analysis was provided in respect of the 
impact location; the munition used, its trajectory and its likely delivery method; and 
the medical effects on the victims. Regarding Khan Shaykhun, expert analysis was 
provided with respect to the nature of the plumes resulting from explosions; the 
characteristics of the crater and their likely cause; the remnants of the munitions; 
the dispersion of sarin; the explosives used and their delivery methods; and the 
medical effects and their treatment. In-depth expert analysis was also provided with 
respect to the chemistry of sarin. 

Leadership Panel’s assessment of the cases 

24. The Leadership Panel reviewed the case files that had been prepared regarding 
the incidents, in which the Mechanism had carefully pieced together all available 
information to determine the evidence obtained in respect of the essential elements 
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of the cases. The results of the respective investigations were assessed according to 
the criteria of credihility and reliahility. 

25. The Leadership Panel determined that, in order to identify those responsible 
for the use of chemical weapons on the dates and at the times of the two incidents in 
which, according to the determination of the Fact-Finding Mission, such use had 
occurred, a finding must be made in accordance with the standards of evidence 
described in the first report of the Mechanism (see S/2016/142). The Panel also 
determined that it must be satisfied that the information used as the basis for its 
findings was credible and reliable and that each significant element was 
corroborated by information from independent sources, including forensic institutes 
and independent scientific experts. 

IV. Assessment, findings and conclusion 

A. Cases under investigation 

26. Umm Hawsh. On 4 May 2017, the Secretary-General transmitted to the 
President of the Security Council the report entitled “Report of the OPCW Fact- 
Finding Mission in Syria regarding the incident of 16 September 2016, as reported 
in the note verbale of the Syrian Arab Republic, number 113, dated 29 November 
2016” (see S/2017/400). In the section of that report entitled “Conclusions”, the 
Fact-Finding Mission confirmed that the two female casualties reported to have 
been involved in the incident in Umm Hawsh of 16 September 2016 had been 
exposed to sulfur mustard. 

27. Khan Shaykhun. Further to a status update by the Fact-Finding Mission 
regarding a reported incident in Khan Shaykhun on 4 April 2017 (see S/2017/440), 
on 30 June 2017 the Secretary-General transmitted to the President of the Security 
Council the document entitled “Report of the OPCW Fact-Finding Mission in Syria 
regarding an alleged incident in Khan Shaykhun, Syrian Arab Republic, April 2017” 
(see S/2017/567). On the basis of its work, the Fact-Finding Mission had concluded 
that a large number of people, some of whom had died, had been exposed to sarin or 
a sarin-like substance, and that such a release could only he determined to have 
been the use of sarin as a chemical weapon. 

B. Leadership Panel’s assessments and findings 

28. The following summarizes the work of the Mechanism and the assessment and 
findings of the Leadership Panel. 

29. Full descriptions of the Mechanism’s investigations into the incidents at Umm 
Hawsh and Khan Shaykhun are contained in annexes I and II, respectively. 

Umm Hawsh 

30. In conducting its comprehensive investigation into the case, the Mechanism 
used as a starting point the information and materials collected and prepared by the 
Fact-Finding Mission. It interviewed 10 witnesses in addition to those questioned by 
the Fact-Finding Mission and again interviewed the two victims. It also collected 
and reviewed significant amounts of additional material, including videos, 
photographs, satellite imagery and medical records. Furthermore, the Mechanism 
obtained independent expert assessments and analysis regarding the munitions used 
and their trajectory, as well as the medical effects on the victims and the treatment 
administered to them. 

31. The Mechanism determined that the incident affecting the two victims had 
occurred on 15 September 2016 at approximately 1500 to 1600 hours. The 
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Mechanism made this finding on the basis of the following: medical records 
indicating that the victims had been admitted to Afrin Hospital on 16 September 
2016, approximately 23 hours after their exposure to the chemical agent; witness 
interviews; and the determination of medical experts that the blisters of the victims 
would have been at least 12 hours old at the time of their initial hospitalization. 

32. On the basis of further witness statements, satellite imagery and verified 
footage from the above-mentioned news crew, the Mechanism found that a second 
incident involving the use of chemical weapons had occurred on the following day, 
16 September 2016, when a mortar shell had been lodged into the pavement 
between 1315 and 1500 hours. 

33. On the basis of witness interviews, the Mechanism determined that a number 
of people in addition to the two victims interviewed by the Fact-Finding Mission 
might have been affected by sulfur mustard and in need of medical attention. Their 
symptoms ranged from slight to severe, with the two victims still suffering from the 
consequences to date. The Mechanism identified and interviewed only the two 
victims. 

34. Regarding the make and origin of the mortar shells, forensic analysis 
determined that the mortar shell recovered from the pavement was of an improvised 
or makeshift origin. On the basis of witness descriptions and a comparative analysis 
of photographs of the mortar shells, experts determined the munition recovered 
from the house to be of the same type as the one found in the pavement. 

35. The forensic institutes and individual experts determined the range of the 
mortar shells to be from 1 to 2 km. The delivery trajectory of the mortar shell found 
in the pavement was determined to have originated from a point somewhere to the 
east or south-east of the village. It was difficult to arrive at a precise determination 
as to the trajectory of the mortar shell that had hit the house. However, on the basis 
of the assessed trajectory of the mortar shell that had damaged the wall of the house, 
combined with that of the munition found in the pavement, forensic analysis 
indicated that the most likely launch point had been somewhere to the east or south¬ 
east of the village. 

36. With respect to identifying those responsible, the Leadership Panel has 
determined that there is sufficient credible and reliable evidence of the following: 

(a) The trajectory of the mortar shell found in the pavement was determined 
to have originated from a point somewhere to the east or south-east of the village. 
The damage to the victim’s house indicated that the mortar shell that had caused it 
had originated from a point south-east of the village; 

(b) Islamic State in Iraq and the Levant (ISIL) was fighting against the 
Syrian Democratic Forces from the outskirts of Umm Hawsh on 15 and 
16 September 2016; 

(c) ISIL was positioned along three sides of Umm Hawsh, specifically to the 
east of the village (the assessed origin of the chemical mortar shells); 

(d) Owing to the limited range (1 to 2 km) of the mortar shells, only ISIL 
and the Syrian Democratic Forces were within striking distance of the impact 
locations; 

(e) As the Syrian Democratic Forces and ISIL were in active combat and 
witness statements and forensic analysis support the conclusion that the mortar 
shells came from the direction of ISIL-held areas, it is very unlikely that the Syrian 
Democratic Forces are responsible for the incident; 
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(f) Unlike ISIL, which was found by the Mechanism to have used sulfur 
mustard in Marea in August 2015 (see S/2016/738/Rev.l), there is no evidence that 
the Syrian Democratic Forces have used sulfur mustard in the past. 

On the basis of the foregoing, the Leadership Panel is confident that ISIL is 
responsible for the use of sulfur mustard at Umm Hawsh on 15 and 16 September 
2016. The findings of the Leadership Panel regarding the evidence in this case are 
based on the information set forth in detail in annex I. 

Khan Shaykhun 

37. Using the findings of the Fact-Finding Mission as a starting point, the 
Mechanism conducted a comprehensive investigation into the release of sarin at 
Khan Shaykhun on 4 April 2017. The Mechanism interviewed 17 witnesses in 
addition to those interviewed by the Fact-Finding Mission and collected and 
reviewed material not obtained by the Fact-Finding Mission. The Mechanism 
obtained substantial information on activities of the Syrian Arab Air Force on 
4 April 2017. 

38. The Mechanism examined eight possible scenarios regarding how the incident 
had occurred. On the basis of the information obtained, the following two scenarios 
were further investigated: (a) sarin had been released through an aerial bomb; or 
(b) sarin had been released through the explosion of an improvised explosive device 
placed on the ground. A third scenario with two alternatives was also investigated, 
neither of which was found to be linked to the release of sarin. 

39. The Mechanism determined that sarin had been released from the location of a 
crater in the northern part of Khan Shaykhun between 0630 and 0700 hours on 
4 April 2017. 

40. On the basis of their review of photographs, videos and satellite images, the 
forensic institutes and individual experts engaged by the Mechanism determined 
that the crater had most likely been caused by a heavy object travelling at high 
velocity, such as an aerial bomb with a small explosive charge. Examining the 
munition remnants observed inside the crater, the institutes and experts concluded 
that the remnants were pieces of a thin-walled munition from 300 to 500 mm in 
diameter and were likely from an aerial bomb. 

41. The Mechanism also examined whether an improvised explosive device could 
have caused the crater. While that possibility could not be completely ruled out, the 
experts determined that that scenario was less likely, because an improvised 
explosive device would have caused more damage to the surroundings than had 
been observed at the scene. Furthermore, no witnesses had reported the placement 
or explosion of an improvised explosive device from the ground. 

42. The Mechanism received information about the operation of Syrian Arab Air 
Force aircraft in the area of Khan Shaykhun indicating that such aircraft may have 
been in a position to launch aerial bombs in the vicinity. At the same time, however, 
Syrian Arab Air Force flight records and other records provided by the Syrian Arab 
Republic make no mention of Khan Shaykhun on 4 April 2017. Furthermore, a 
representative of the Syrian Arab Air Force stated to the Mechanism that no Syrian 
Arab Air Force aircraft had attacked Khan Shaykhun on 4 April 2017. 

43. The Mechanism received conflicting information about the deployment of 
aircraft in Khan Shaykhun that morning. On 6 and 13 April 2017, the Government 
of the Syrian Arab Republic had made public statements that the Syrian Arab Air 
Force had bombed Khan Shaykhun with conventional bombs at approximately 1130 
to 1200 hours. Furthermore, the Mechanism obtained original video footage from 
two separate witnesses that showed four plumes caused by explosives across Khan 
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Shaykhun. The footage was confirmed by forensic analysis to be authentic and to 
have been filmed in Khan Shaykhun between 0642 and 0652 hours on 4 April 2017. 

44. The Mechanism examined the nature of the rescue and health-care operations 
following the mass casualty situation caused by the release of sarin in Khan 
Shaykhun. At present, the Mechanism cannot verify the total number of persons 
who either died or were injured as a result of the attack, but concludes, on the basis 
of its interviews with victims and medical personnel, its review of medical records 
and its consultations with medical experts whom it has engaged, that the response to 
the incident largely correlated to the reported number of casualties and victims. 

45. The Mechanism commissioned an in-depth laboratory study of the origin of 
the precursor chemical methylphosphonyl difluoride (DF) used to produce the 
binary sarin released in Khan Shaykhun. The study revealed that the sarin had most 
likely been made with the precursor DF from the original stock from the Syrian 
Arab Republic. An initial screening of reports concerning previous incidents of the 
release of sarin in the Syrian Arab Republic showed that some “marker chemicals” 
appeared to be present in environmental samples. This would warrant further study. 
This finding relates only to the origin of the DF used as a precursor, not to those 
responsible for the dissemination of sarin. 

46. With respect to identifying those responsible, the Leadership Panel has 
determined that the information that it has obtained constitutes sufficient credible 
and reliable evidence of the following: 

(a) Aircraft dropped munitions over Khan Shaykhun between 0630 and 0700 
hours on 4 April 2017; 

(b) An aircraft of the Syrian Arab Republic was in the immediate vicinity of 
Khan Shaykhun between 0630 and 0700 hours on 4 April 2017; 

(c) The crater from which the sarin emanated was created on the morning of 
4 April 2017; 

(d) The crater was caused by the impact of an aerial bomb travelling at high 
velocity; 

(e) A large number of people were affected by sarin between 0630 and 0700 
hours on the morning of 4 April 2017; 

(f) The number of persons affected by the release of sarin on 4 April 2017, 
and the fact that sarin reportedly continued to be present at the site of the crater 
10 days after the incident, indicate that a large amount of sarin was likely released, 
which is consistent with its being dispersed through a chemical aerial bomb; 

(g) The symptoms of victims and their medical treatment, as well as the 
scale of the incident, are consistent with a large-scale intoxication of sarin; 

(h) The sarin identified in the samples taken from Khan Shaykhun was found 
to have most likely been made with a precursor (DF) from the original stockpile of 
the Syrian Arab Republic; 

(i) The irregularities described in annex II are not of such a nature as to call 
into question the aforementioned findings. 

On the basis of the foregoing, the Leadership Panel is confident that the Syrian Arab 
Republic is responsible for the release of sarin at Khan Shaykhun on 4 April 2017. 
The findings of the Leadership Panel regarding the evidence in this case are based 
on the information set forth in detail in annex II. 
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V. Other activities 

A. Interaction with Member States and the Organisation for the Prohibition of 
Chemical Weapons 

Syrian Arab Republic 

47. In accordance with resolution 2235 (2015), the Syrian Arab Republic, and all 
parties in that country, are to fully cooperate with the Mechanism, including by 
providing full access to all locations, individuals and materials in the Syrian Arab 
Republic that the Mechanism deems relevant to its investigation. The Syrian Arab 
Republic engaged constructively with the Mechanism and demonstrated its 
commitment to cooperating with the Mechanism and facilitating its requests for 
access to information and witnesses. The Mechanism maintained regular contact 
with the relevant authorities of the Syrian Arab Republic. 

48. The Mechanism engaged with the Syrian Arab Republic for planning purposes, 
including by requesting that a liaison officer be based in Damascus. The Mechanism 
received a positive response to that request on 11 July 2017 and thereafter 
commenced planning to visit the country. 

49. In letters dated 5 and 19 July 2017, the Head of the Mechanism requested that 
the Government of the Syrian Arab Republic provide official records regarding 
arrangements and movements at Sha‘irat airbase with respect to 4 April 2017. 

50. During the first visit to Damascus by members of the Leadership Panel, from 
19 to 21 August 2017, the Government of the Syrian Arab Republic provided all 
materials requested by the Mechanism. During that mission, the Head of the 
Mechanism met with representatives of the Government, including the Deputy 
Minister for Foreign Affairs and Expatriates and members of the armed forces. 

51. During the Mechanism’s second visit to Damascus, from 7 to 11 September 
2017, a technical team of the Mechanism conducted witness interviews, collected 
information and met with representatives of the Government, including officials 
from the Syrian Scientific Studies and Research Centre. 

52. During its third visit, from 8 to 10 October 2017, the Mechanism went to 
Sha‘irat airbase. After having received information provided by the Syrian Arab 
Republic during its first and second visits to Damascus, the Mechanism considered 
that such a visit would he of value to its investigation into the incident at Khan 
Shaykhun. The technical visit had the following objectives: (a) to verify the 
authenticity of the logbooks and flight operations records from 4 April 2017; (b) to 
review entry and exit logs and interview responsible personnel; (c) to photograph 
the types of munitions flown on 4 April 2017 in accordance with the logs received; 
and (d) to photograph the mechanisms for attaching such munitions onto Sukhoi 
Su-22 aircraft. Collecting samples at the airbase was not an objective of the visit; 
the Mechanism had determined that doing so would not advance the investigation. 
The Mechanism considered that if a single chemical munition had been flown from 
the airbase, there was little chance of finding any trace of sarin or its degradation 
products at an airbase of that size without specific information as to where to collect 
samples. 

53. In addition to carrying out those visits to the Syrian Arab Republic, the 
Leadership Panel held regular meetings with representatives of the Syrian Arab 
Republic in New York. 

54. As stated in the fourth, fifth and sixth reports of the Mechanism 
(see S/2016/888, S/2017/131 and S/2017/552), on 10 October 2016 the Syrian Arab 
Republic notified the Mechanism that the Syrian national committee had opened an 
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internal investigation, which included flight plans and air operations. To date, the 
Syrian Arab Republic has not provided the Mechanism with the outcomes of the 
investigation. 

Organisation for the Prohibition of Chemical Weapons 

55. The Mechanism’s investigation initially commenced with a comprehensive 
review and analysis of all the information collected and prepared by the Fact- 
Finding Mission regarding the two cases. This comprised 2,554 files, which 
included documents, video interviews, audio recordings, photographs and laboratory 
results. 

56. OPCW provided the Mechanism with three technical experts who were 
deployed with the Mechanism’s technical team to visit Sha‘irat airbase. The experts 
provided the Mechanism with additional specialized skills, including to ensure the 
safety of the operation. 

57. OPCW also provided invaluable support through its laboratory and its 
designated laboratory network. 

58. The Leadership Panel was in regular contact with the Director-General of 
OPCW both from New York and in The Hague. Moreover, the Mechanism interacted 
with OPCW on a frequent basis throughout the Mechanism’s mandate. 

Information from Member States 

59. The Leadership Panel sent formal requests for information to Member States, 
including the Syrian Arab Republic, members of the Security Council and countries 
in the region, on three occasions. The requests for information were sent on 15 June 
2017, regarding the case at Umm Hawsh; on 5 July 2017, regarding the case at Khan 
Shaykhun; and on 30 August 2017, regarding both cases. The Mechanism also sent 
tailored follow-up requests regarding both cases to a number of Member States that 
had responded to the initial requests. 

60. Twelve Member States provided case-specific information, which was 
subjected to the same rigorous review and analysis as other information gathered. 
The Mechanism always sought to collect additional material from at least one other 
independent source for corroboration purposes. 

61. Throughout the reporting period, the Leadership Panel met with Member 
States, including members of the Security Council. This was also an opportunity to 
brief Member States on the general status of the work of the Mechanism and to 
engage with regional States. In addition, members of the Leadership Panel visited 
the capitals of four Member States, including the Syrian Arab Republic, at their 
invitation, to be briefed on specific aspects of the two cases. 

Allegations from Member States 

62. Since the issuance of its sixth report on 28 June 2017, the Mechanism has 
formally received 15 allegations related to non-State actors’ acquisition, possession 
or transfer of, or intent to use, chemical weapons or toxic chemicals. Two 
allegations specifically referred to ISIL. Thirteen allegations also included the 
acquisition of missiles and rockets fitted with toxic chemicals by non-State actors, 
including seven allegations involving the Nusrah Front. Those allegations were 
shared with OPCW. 
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B. Consultation with United Nations counter-terrorism and non-proliferation bodies 

63. In fulfilling its mandate, the Mechanism consulted appropriate United Nations 
counter-terrorism and non-proliferation bodies to exchange information, as 
encouraged in resolution 2319 (2016), including with the experts of those bodies. 

C. Information management 

64. The Mechanism took measures to ensure that its personnel complied with the 
confidentiality and security protection requirements set out in the memorandum of 
understanding concluded between the Mechanism and OPCW on 26 November 
2015, concerning the provision of access to and the storage and handling of 
information. 

65. All personnel and all other individuals and entities with whom the Mechanism 
engaged were also required to enter into confidentiality undertakings. 

66. The Mechanism followed standard operating procedures and guidelines on 
information management (see S/2016/888, annex), as well as on the conduct of 
interviews and the collection of evidence and information, including chain-of- 
custody forms. In addition, the Mechanism applied the Secretary-General’s bulletin 
on information sensitivity, classification and handling (ST/SGB/2007/6) in relation 
to the information collected and produced by the Mechanism. Furthermore, relevant 
sections of the Secretary-General’s bulletin on record-keeping and the management 
of United Nations archives (ST/SGB/2007/5), concerning the creation, management 
and disposition of records, were applied by the Mechanism. 

VI. Challenges, risks and constraints 

67. While the Mechanism actively collected information relevant to its 
investigations from a range of sources, it also depended on Member States to assist 
by providing quality information in a timely manner. 

68. The conditions for receiving information in a highly sensitive political 
environment with complex security considerations made the investigation extremely 
challenging. On-site visits were subject to high security risks. Moreover, as an 
investigative body without judicial powers, the Mechanism relied on the voluntary 
cooperation of witnesses, was required to meet strict standards of confidentiality in 
all its operations, and was to ensure the safety of witnesses without any means of 
witness protection. 

VII. Way forward 

69. The Leadership Panel understands that several additional cases are currently 
subject to fact-finding missions. On the basis of its recent work, the Leadership 
Panel commends the continued scientific progress and development that have 
provided invaluable support for complex investigations of this nature. In that regard, 
it is important to maintain and enhance a network of internationally recognized 
experts on these issues. 

70. The Leadership Panel notes that the investigations conducted during the 
reporting period provided a series of important lessons for future investigations of 
this nature, which should be captured by conducting a comprehensive lessons- 
learned exercise. 
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71. It is vital that the international community maintain an effective investigative 
capacity to rapidly respond to any future use of chemical weapons, including acts of 
chemical terrorism. 

VIII. Concluding remarks 

72. The Leadership Panel is deeply concerned by the finding of the Fact-Finding 
Mission that chemical weapons — sulfur mustard and sarin — were used. The Panel 
expresses its shock and dismay at the existence and use of these weapons in the 
Syrian Arab Republic, and its deep sympathy to those affected by them. The Panel 
encourages the international community not only to make united efforts to ensure 
that such use will not be repeated, but also to provide assistance to those affected. 

73. The continuing use of chemical weapons, including by non-State actors, is 
deeply disturbing. If such use, notwithstanding its prohibition by the international 
community, is not stopped now, a lack of consequences will surely encourage others 
to follow, not only in the Syrian Arab Republic, but also elsewhere. This is the time 
to bring these acts to an end. 

74. The Leadership Panel wishes to give recognition to the professionalism, 
dedication and sacrifice of its staff, and to express its deep appreciation for all their 
work and commitment during the reporting period. 

75. The Leadership Panel extends its appreciation for the support received from 
the United Nations Secretariat, in particular the Office for Disarmament Affairs, and 
from OPCW, which provided invaluable technical and logistical support to the 
Mechanism. 
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Annex I 


Umm Hawsh 

I. Findings of the Organisation for the Prohibition of Chemical 
Weapons Fact-Finding Mission in the Syrian Arab Republic 

1. On the basis of interviews conducted with witnesses, including a visit to the 
Syrian Scientific Studies and Research Centre in Barzah to conduct physical 
examinations of items related to the reported incidents, the documents reviewed and 
the results of blood sample analyses, the Organisation for the Prohibition of 
Chemical Weapons (OPCW) Fact-Finding Mission in the Syrian Arab Republic 
confirmed that the two female casualties reported to have been involved in the 
incidents in Umm Hawsh on 15 and 16 September 2016 had been exposed to sulfur 
mustard. Furthermore, the Fact-Finding Mission stated that it had conducted a 
thorough technical weapon exploitation on a 217-mm-calibre mortar. Supported by 
the results of laboratory analyses, the Fact-Finding Mission determined that that 
mortar shell contained sulfur mustard. 

II. Investigation by the Mechanism 

2. The Mechanism formulated possible scenarios to ensure that it approached the 
investigation comprehensively and in an objective and impartial manner. While the 
Mechanism sought to collect and analyse as much information as possible in 
connection with each scenario, by the end of the investigation most of the 
information obtained supported one scenario: that sulfur mustard munitions, one of 
which had caused the exposure of the victims, had been fired on Umm Hawsh by an 
actor. 

Background 

3. Umm Hawsh (also known as Um Hosh) is a village in Aleppo Governorate 
(Marea subdistrict, I‘zaz District). It is located at coordinates 36°24'51.12"N, 
37°12'38.16"E, in the midst of a triangle of three larger cities: Aleppo, I‘zaz and 
Bab. Umm Hawsh is approximately 23 km north-east of Aleppo city and 35 km 
south of the Bab al-Salam border crossing with Turkey. It is located in a fork 
between two motorways to the north of Aleppo, that is, east of the M214 and west 
of the M20 motorways. 

4. In 2004, the population of Umm Hawsh, according to Syrian census data from 
that year, was 3,542. At the time of the incidents in September 2016, the population 
of Umm Hawsh was estimated to be 728. 

5. Umm Hawsh and the surrounding area fell under the control of Islamic State 
in Iraq and the Levant (ISIL) on 9 August 2015. It was taken over by the Syrian 
Democratic Forces on 30 August 2016. Additional non-State armed groups were 
present approximately 8 km to the north of Umm Hawsh, in Marea. The forces of 
the Syrian Arab Republic and its allies were not present in Umm Hawsh at the time 
of the incidents; the closest that they appear to have been was 8.7 km away in 
Misqan. By the time of the sulfur mustard incident, the front-line and conflict 
dynamics had not changed since Umm Hawsh had been captured by the Syrian 
Democratic Forces on 30 August 2016. At that time, ISIL remained from 600 to 800 
m east and 1 km north of the village, with an additional presence to the south of the 
village. 
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Date and time 

6. The incident leading to the exposure of the victims to sulfur mustard has been 
determined to have occurred at a house in Umm Hawsh at approximately 1500 to 
1600 hours on Thursday, 15 September 2016. The Mechanism based that finding on 
the following: medical records indicating that the victims had been admitted to 
Afrin Hospital on 16 September 2016, approximately 23 hours after their exposure 
to the chemical agent; witness interviews; and the assessment of medical experts 
that the blisters of the victims would have been at least 12 hours old at the time of 
their initial hospitalization. 

7. The Mechanism found that the following day, Friday, 16 September, a mortar 
shell had been lodged in a pavement in the village at approximately 1315 to 1500 
hours. That assessment is based on verified media footage, witness statements and 
analysis of satellite imagery. 

Impact location 

8. The Mechanism determined the location of the house 1 struck by a mortar shell 
through a variety of means. One of the victims, who lived in the house, identified 
the location on the basis of photographs presented during an interview with the 
Mechanism. The photographs included images of the house, the street and the 
village. Moreover, the information regarding the location of the house was 
corroborated through forensic analysis, the statements of several other witnesses, a 
review of satellite imagery and the findings of the Fact-Finding Mission. The 
identification of the location was also supported by original videos provided to the 
Mechanism showing damage to the house. 

9. The mortar shell in the pavement was determined to be located at 
approximately 36°24'43.29"N, 37°12'31.16"E. The identification of the location was 
based on forensic analysis of video footage taken by news crews who filmed the 
munition still protruding from the pavement. The finding regarding the location of 
the mortar shell in the pavement was corroborated through analysis of satellite 
imagery, the statements of three witnesses and the findings of the Fact-Finding 
Mission and the chemical, biological, radiological and nuclear defence team of the 
Russian Federation. 

Munition analysis 

10. Several witnesses interviewed by the Mechanism confirmed that a mortar shell 
or a munition had hit the house of one of the two victims. The mortar shell had not 
been recovered, as the owner of the house had thrown it away sometime after the 
incident. However, a news crew had photographed a damaged mortar shell the 
following day and provided images to the Mechanism. The owner of the house 
identified the mortar shell from photographs taken by the news crew. A forensic 
institute and an expert engaged by the Mechanism who specializes in energetic 
materials stated that the mortar shell that had hit the house was very likely the same 
type as the mortar shell found in the pavement. A defence research institute, a 
forensic institute and an expert consultant, all engaged by the Mechanism, observed 
that the mortar shell recovered from the pavement was of poor production quality. 
After the munition had hit the house, five witnesses described qualities, such as 
smell, indicating that the mortar shell contained sulfur mustard. 


While the Mechanism obtained the geographical coordinates of the house damaged by the mortar, 
its location is not included in the present report as a result of concern for the safety and security 
of the victims. 
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11. With respect to the origin of the mortar shells, experts in energetic materials 
noted that the mortar shell recovered from the pavement had an appearance similar 
to those made through makeshift large-scale production methods. The Fact-Finding 
Mission established that the munition found in the pavement was a 217-mm-calibre 
mortar shell. Mortars fitting 217-mm-calibre mortar shells are easily produced from 
available high-quality steel tubing. The range of such munitions is from 1 to 2 km. 
On the basis of the limited information available, a defence research institute 
commissioned by the Mechanism concluded that it was impossible to identify the 
manufacturer(s) of the munitions. 

12. Regarding the characteristics of the munition that had caused damage to the 
house, an expert in energetic materials noted that, on the basis of a review of 
photographs and video footage, the damage was consistent with having been caused 
by a mortar shell fired from a mortar with a calibre of approximately 220 mm. 
According to the Fact-Finding Mission, the mortar shell in the pavement contained 
sulfur mustard. The pavement was not seriously damaged, and there was likely 
residual contamination from the leaking munition. A forensic institute observed that 
the lack of a major explosion suggested that these mortar shells were designed to 
carry a chemical agent. Regarding the penetration of the pavement by the mortar 
shell, two experts in energetic materials observed that it had occurred with little sign 
of damage to either the mortar shell or the pavement itself. Both experts tried to find 
an explanation, with one noting that there was little resistance in the pavement 
because of an observed pre-existing cavity, which the mortar shell had penetrated. 

13. With respect to the range of the mortar shells, forensic institutes and experts 
commissioned by the Mechanism determined the distance from where they had been 
launched to the impact site to be from 1 to 2 km. They also noted that the range and 
accuracy of homemade mortar shells are imprecise and depend on a number of 
variables, including the amount of explosive powder used. 

14. In addition, the same experts determined the trajectory of the mortar shell 
found in the pavement to have originated from a point to the east or south-east of 
the village. Witnesses confirmed that it had originated from the eastern side of Umm 
Hawsh. The assessed trajectory of the mortar shell that had struck the house was 
less precise, as it was based on the damage caused to the wall of the house. That 
trajectory was determined to be an arc from due east to nearly due west, with its 
subjective central line originating from the south-east. 

Medical effects and response 

15. When interviewed by the Mechanism, the victim stated that, upon finding the 
house had been damaged by the mortar shell, she had commenced cleaning the 
house with her bare hands using laundry detergent. She later asked a neighbour to 
help. Both cleaned for approximately four hours, until after the Maghrib call to 
prayer. The owner of the house reported becoming sick at about that time, including 
experiencing visual impairment. She took a shower, and later felt dizzy and 
vomited. The following morning, members of the Syrian Democratic Forces took 
the victim to Tall Rif‘at Hospice; however, no doctors were available at the time. 
Later that day, they went to Afrin Hospital, where the victim lost consciousness. A 
week later, the victim awakened with bandaged hands. She was subsequently 
admitted to a hospital in Damascus. The neighbour who helped to clean the house 
also became sick and went to the hospital. 

16. The Mechanism also interviewed the victim’s neighbour, who stated that she 
had tried to clean the “oil” away using water and laundry detergent. At the start of 
the cleaning process, the victim could smell the chemical, but then grew somewhat 
accustomed to it. She went home to take a shower and later became dizzy and could 
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not eat or drink. After going to a relative’s house, the victim fell to the ground and 
began to vomit, before losing consciousness. By the next morning, she could no 
longer see and was transported to a hospital by relatives. They first went to Ahras 
Medical Centre, where the victim was treated. By that time, her whole body had 
become swollen and had developed blisters. By 1000 to 1100 hours, the victim had 
been taken to Afrin Hospital, where she stayed for 20 days. Still in poor condition, 
the victim then went to Kafr Naya Hospice and later to a hospital in Damascus. The 
victim could not speak, and her chest felt tight for a month. 

17. Several sources indicate that other civilians and three fighters from non-State 
armed groups were also affected by the chemical incident. This information is only 
partially corroborated by one witness, who stated that Afrin Hospital had received 
one male adult and two children with mild symptoms as ambulant patients on 
16 September 2016. Another witness suggested that a number of children had also 
been affected and taken to the hospital. This could not be corroborated by the 
Mechanism. Another witness insisted that the hospital had not received additional 
patients with similar symptoms, but only those two cases. 

18. An additional witness indicated to the Mechanism that a relative had cleaned 
the furniture contaminated with sulfur mustard and, as a result, had developed minor 
symptoms on the fingers. 

19. While a number of other people may have been affected by the sulfur mustard 
incident and needed medical attention, only two of them were identified and 
interviewed by the Mechanism. The victims’ symptoms included large blisters on 
their upper and lower limbs and faces; they continue to suffer from the 
consequences of sulfur mustard exposure to date. Clinical toxicologists engaged by 
the Mechanism confirmed the exposure of the victims to sulfur mustard and noted 
that it might have permanent implications for their health. 

Chemistry 

20. The chemical agent that affected the victims is sulfur mustard. It is a blistering 
agent whose precursor chemicals are relatively cheap and easy to acquire. 

21. The Fact-Finding Mission conducted chemical analysis of the samples of 
sulfur mustard. It concluded that the presence and relevant quantities of disulfide 
and trisulfide mustard analogues indicated that this mustard was most likely 
produced using the Levinstein chemical reaction process, which is widely 
understood to be an alternative and relatively uncomplicated method of producing 
sulfur mustard to which non-State actors might turn. 

22. Witnesses and open sources point to ISIL as a possible perpetrator of the 
chemical attack. Information provided to the Mechanism indicates that ISIL had 
developed the capability to produce sulfur mustard as of 2015. ISIL had ample 
access to industrial zones, including oil and gas fields, in which to produce the 
relevant delivery systems, munitions and chemicals. ISIL has a historical record of 
using sulfur mustard, including in August 2015 in Marea (just 7.4 km north of Umm 
Hawsh). In its third report (S/2016/738/Rev.l), the Mechanism found that ISIL had 
the capacity to produce sulfur mustard through the Levinstein process. 

III. Assessment and findings by the Leadership Panel 

23. In order to determine, to the greatest extent feasible, those who were 
perpetrators, organizers, sponsors or otherwise involved in the use of sulfur mustard 
on 15 and 16 September 2016 in Umm Hawsh, the Leadership Panel requested that 
the investigators examine four possible scenarios regarding how the events had 
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unfolded. Upon the conclusion of the investigation, the prevailing scenario that 
emerged was that sulfur mustard munitions, one of which had caused the exposure 
of victims, had been fired on Umm Hawsh by an actor. 

24. Most of the information collected and analysed by the Mechanism supports 
this scenario. The majority of the evidence suggests that the munitions were fired 
from a location to the east or south-east, where one particular actor (ISIL) was 
positioned at the time of the incident. 

25. With respect to identifying those responsible, the Leadership Panel has 
determined that the information that it has obtained constitutes sufficient credible 
and reliable evidence of the following: 

(a) The trajectory of the mortar shell found in the pavement was determined 
to have originated from a point to the east or south-east of the impact location. The 
damage caused to the victim’s house indicated that the trajectory of the mortar shell 
that had caused it had originated from a point to the south-east; 

(h) ISIL was fighting against the Syrian Democratic Forces from the 
outskirts of Umm Hawsh on 15 and 16 September 2016; 

(c) ISIL was positioned along three sides of Umm Hawsh, specifically to the 
east and south-east of the village (the assessed origin of the chemical mortar shells); 

(d) Owing to the limited range (1 to 2 km) of the mortar shells, only ISIL 
and the Syrian Democratic Forces were within striking distance of the impact 
locations; 

(e) As the Syrian Democratic Forces and ISIL were in active combat and 
witness statements and forensic analysis support the conclusion that the mortar shell 
came from the direction of ISIL-held areas, it is very unlikely that the Syrian 
Democratic Forces were responsible for the incident; 

(f) Unlike ISIL, which was found by the Mechanism to have used sulfur 
mustard in Marea in August 2015 (see S/2016/738/Rev.l), there is no evidence that 
the Syrian Democratic Forces have used sulfur mustard in the past. 

On the basis of the foregoing, the Leadership Panel is confident that ISIL is 
responsible for the use of sulfur mustard at Umm Hawsh on 15 and 16 September 
2016. The findings of the Leadership Panel regarding the evidence in this case are 
based on the information set forth in detail in the present annex. 
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Annex II 


Khan Shaykhun 

I. Findings of the Organisation for the Prohibition of Chemical 
Weapons Fact-Finding Mission in the Syrian Arab Republic 

1. On the basis of its analysis of biomedical specimens, interviews and 
supplementary material submitted during the interview process, as well as analysis 
of environmental samples, the Organisation for the Prohibition of Chemical 
Weapons (OPCW) Fact-Finding Mission in the Syrian Arab Republic found that a 
large number of people, some of whom had died, had been exposed to sarin or a 
sarin-like substance at Khan Shaykhun on 4 April 2017. While it had received 
limited information on the dispersal mechanism and therefore had been unable to 
draw firm conclusions on that specific matter, it considered that the release that had 
caused the exposure was likely to have been initiated in the crater in the road, 
located close to the silos in the northern part of the town. It concluded that, on the 
basis of such a release, the only determination that could be made was that sarin had 
been used as a weapon. 

II. Investigation by the Mechanism 

2. Upon receiving the final report of the Fact-Finding Mission on the incident of 
4 April 2017 at Khan Shaykhun, the Mechanism conducted an in-depth investigation 
into the incident. The Leadership Panel defined the scope of the investigation by 
adopting an investigation plan that outlined eight possible scenarios, including those 
put forward by Member States, regarding how sarin had been released in Khan 
Shaykhun. While the Mechanism sought to collect and analyse as much information 
as possible in connection with each scenario, by the end of the investigation most of 
the information obtained supported three scenarios: (a) sarin had been delivered 
through an aerial bomb that had been dropped by an aircraft; (b) sarin had been 
released from the ground as part of a staged attack; or (c) there had been an air 
strike by the Syrian Arab Air Force against a storage facility containing toxic 
chemicals, which had resulted in the dispersion of a toxic cloud. 

3. The first scenario is based on reports that aircraft were either seen or heard 
dropping bombs over Khan Shaykhun early in the morning on 4 April 2017. Sarin is 
believed to have emanated from a point of impact on a road (hereinafter referred to 
as “the crater”) caused by an aerial bomb, located close to silos in the northern part 
of Khan Shaykhun. 

4. The second scenario is based on a report that sarin was released from the same 
crater as that in the first scenario, caused by an explosive charge placed on the 
ground containing sarin, so as to stage an attack for which the Government of the 
Syrian Arab Republic would be blamed. 

5. The third scenario involves a reported strike by the Syrian Arab Air Force on 
an ammunition depot on the eastern outskirts of Khan Shaykhun where workshops 
had been producing chemical warfare munitions. In a public statement, the 
Government of the Syrian Arab Republic stated that the Syrian Arab Air Force had 
only conducted an attack in Khan Shaykhun at around noon on 4 April 2017. An 
alternative third scenario is that a house in Khan Shaykhun that had been taken over 
by a non-State armed group and used for the storage of toxic chemicals was bombed 
on 4 April 2017, thus releasing toxic chemicals. 
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Background 

6. Khan Shaykhun is both a town and a subdistrict of Ma‘arrat al-Nu‘man 
District, within the governorate of Idlib in north-western Syrian Arab Republic, with 
the coordinates 35.44°N, 36.65°E, at 376 m above sea level. Located about 10 km 
from the border of Hama Governorate to the south and about 100 km from Aleppo 
Governorate to the north, Khan Shaykhun is positioned on the M5 motorway, which 
runs from the Jordanian border in the southern part of the country, through 
Damascus city and to Aleppo city in the northern part of the country. 

7. Recent information available to the Mechanism estimates that the subdistrict 
of Khan Shaykhun has a population of approximately 34,000, with the town itself 
having a population of 16,000. 

8. A review of open-source information indicates that, in mid-2014, the Nusrah 
Front launched an offensive in southern Idlib Governorate and seized the town of 
Khan Shaykhun. According to witness statements as well as open sources, on the 
date of the incident on 4 April 2017, the Levant Liberation Organization, which 
includes the Nusrah Front as its major component, had a prominent presence in the 
area of Khan Shaykhun, with Ahrar al-Sham also being present in the general area, 
along with several other non-State armed groups. 

9. A review of open sources also indicates that, on 21 March 2017, the Levant 
Liberation Organization and its allied groups launched an offensive against forces of 
the Syrian Arab Republic in the direction of Hama city from its positions in northern 
Hama Governorate. By 23 March 2017, the Levant Liberation Organization and its 
allied groups reportedly advanced to areas 3 to 5 km from the Hama city line and 
threatened to capture the Hama military airport. On 24 March 2017, Ahrar al-Sham 
and its allied groups reportedly launched a separate offensive in north-western 
Hama Governorate. Open-source information suggests that at around the same time, 
Syrian government forces started to gain momentum, although with some temporary 
setbacks, in repelling these attacks. Reinforcements reportedly arrived from other 
parts of the Syrian Arab Republic. Syrian government forces were also reportedly 
aided in repelling air attacks on locations in northern Hama and southern Idlib 
governorates. According to the Director-General of OPCW, sarin was found to have 
been released in Lataminah on 30 March 2017. By 3 April 2017, Syrian government 
forces had made rapid advances, reportedly regaining control over most of the areas 
lost after 21 March 2017, and had moved deeper into some of the areas that had 
been controlled by non-State armed groups prior to 21 March. Media sources 
indicate that, between 17 March and 3 April 2017, aerial attacks were carried out on 
a regular basis against targets in Khan Shaykhun. 

Date and time 

10. On the basis of witness statements and forensic analysis of photographs and 
video footage, the Mechanism found that the sarin incident had occurred in Khan 
Shaykhun between 0630 and 0700 hours local time on 4 April 2017. Moreover, the 
Mechanism collected multiple reports released by the media during the morning of 
4 April 2017, which indicated that a “chemical attack” had occurred in Khan 
Shaykhun between 0630 and 0700 hours. 

11. Witnesses reported that the alleged attack in Khan Shaykhun on 4 April 2017 
had been carried out by an aircraft between 0630 and 0700 hours. The Mechanism 
obtained original photographs and video footage from witnesses showing plumes on 
the morning of 4 April 2017, indicating that several explosions had occurred in 
Khan Shaykhun between 0630 and 0700 hours. On the basis of forensic analysis, it 
was determined that the plume videos and images had been recorded on 4 April 
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2017 between 0642 and 0652 hours. Further forensic analysis confirmed that the 
footage had not been manipulated and had been taken on the outskirts of Khan 
Shaykhun. 

12. Moreover, on the basis of satellite images from 3 April 2017, which do not 
show the presence of the crater at that time, the Mechanism has confidence that the 
crater was caused by an impact on 4 April 2017. 

Early warning 

13. Witnesses interviewed by the Mechanism described an “early warning system” 
(commonly referred to as “spotters”, “observers” or “observatories”) that possibly 
played a role in warning residents of the attack on 4 April 2017. By intercepting 
communications between aircraft of the Syrian Arab Air Force and the bases from 
which they are operated, members of the spotter network monitor flight activities 
and communicate early warning information to residents about impending air 
strikes. 

14. The Mechanism collected information from witnesses to the effect that a first 
warning of a possible upcoming chemical attack had been received by the “Syria 
Civil Defence” (also known as the “White Helmets”) and spotters in Khan 
Shaykhun. Witnesses stated that the Syria Civil Defence in Khan Shaykhun had 
been in contact by way of the Internet with spotters and that, at approximately 
0630 hours on 4 April 2017, the spotters had announced that a Sukhoi Su-22 
military aircraft had taken off from Sha‘irat airbase. A witness interviewed by the 
Mechanism, who reported having worked that morning as a spotter in Khan 
Shaykhun, recalled having received an alert concerning the take-off of a Su-22 from 
Sha‘irat airbase on the morning of 4 April 2017. The witness stated that the alert had 
advised residents to be careful, as the aircraft was likely carrying toxic chemicals. 

15. The Mechanism noted several witness statements suggesting that, on the 
morning of 4 April 2017, the early warning system might not have been fully 
functional. The Syria Civil Defence reported that, when the members of the first 
volunteer team had responded to the air strike, they had had no idea that it was a 
chemical attack and that they had all been poisoned. Several witnesses stated that 
there had been no warning of an attack on the morning of 4 April, while others 
reported having received alerts at various times between 0630 and 0715 hours that 
morning. 

16. While there are varying accounts as to whether the early warning system was 
fully functional that morning, the above information gathered by the Mechanism 
neither supports nor excludes any of the three scenarios. 

Air deployment 

17. While there are varying accounts of the nature and timing of the attack, and 
the subsequent number of explosions, several witnesses interviewed by the 
Mechanism and the Fact-Finding Mission stated that they had seen or heard aircraft 
flying over Khan Shaykhun in the early morning of 4 April 2017, in keeping with 
the scenario in which aircraft dropped bombs on Khan Shaykhun that morning. 

18. The Mechanism collected two original videos, filmed by two witnesses from 
different angles, showing several plumes; the videos were confirmed by forensic 
institutes to have been filmed between 0642 and 0652 hours during the morning of 
4 April 2017. Forensic analysis of the videos found that, at a certain point in each 
video, the sound of an aircraft could be heard in the background along with an 
explosion. 
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19. The Mechanism investigated whether a Syrian Arab Air Force Su-22 had taken 
off from Sha‘irat airbase, located 110 km south of Khan Shaykhun, and launched an 
air attack on the town that morning. The Governments of France and the United 
States of America publicly provided information indicating that a Syrian Arab Air 
Force Su-22 had taken off from Sha‘irat airbase on 4 April 2017, flown over Khan 
Shaykhun at 0637 and 0646 hours, and launched up to six attacks around Khan 
Shaykhun. 

20. The Mechanism requested that the Syrian Arab Republic provide official 
records with respect to activities carried out at Sha‘irat airbase on 4 April 2017, 
including logbooks of all operations, movements at the airbase, flights, names of the 
pilots flying aircraft and a detailed map or plan showing the layout of the airbase. In 
response to that request, the Government provided the Mechanism with a set of 
copies of official documents relating to Sha‘irat airbase, including extracts from 
handwritten Syrian Arab Air Force logbooks as well as a document detailing the 
airbase chain of command and an aerial image of the airbase. 

21. During its visit to Sha‘irat airbase, the Mechanism observed that the 
documents provided by the Syrian Arab Republic appeared to be copies of the 
originals. The technical visit had the following objectives: (a) to verify the 
authenticity of the logbooks and flight operation records from 4 April 2017; (b) to 
review entry and exit logs and interview responsible personnel; (c) to photograph 
the types of munitions flown on 4 April in accordance with logs received; and (d) to 
photograph the mechanisms by which such munitions were attached to Su-22 
aircraft. 

22. The Mechanism found no entries in any of the documents that referred 
specifically to Khan Shaykhun on 4 April 2017. Two entries in a logbook provided 
details regarding the time of execution of missions that corresponded to the time 
frame of the release of sarin at Khan Shaykhun. The operations relating to those 
flights had been logged as aerial attacks using conventional munitions targeting 
non-State armed groups in the vicinity of Kafr Zayta and Tall Hawash, situated 
approximately 8 km south-west and 18 km west of Khan Shaykhun, respectively. 

23. The Mechanism interviewed the pilot associated with one of the entries in the 
logbook, who used the call sign “Quds 1” and had flown a Su-22 at the relevant 
time that day. The pilot stated that no chemical weapons had been used and that the 
mission that morning had been to carry out an attack to the west of Kafr Zayta using 
three 500 kg conventional munitions. This was found to be consistent with the 
details recorded in the logbook. According to the pilot, the closest distance to Khan 
Shaykhun flown on that date had been approximately 7 to 9 km, to carry out an 
attack against targets west of Kafr Zayta. While the Mechanism was able to confirm 
severe structural damage to a building in the general vicinity of one of those targets 
through analysis of satellite imagery, it could not precisely determine when the 
damage had occurred. 

24. The Mechanism did not interview the pilot associated with the second entry. 
The Syrian Arab Republic informed the Mechanism that the pilot had later been shot 
down and was missing in action. 

25. Taking samples was not an objective of the visit to Sha‘irat airbase. The 
Mechanism had determined that the collection of samples at the airbase would not 
advance the investigation. The Mechanism considered that if a single chemical 
munition had been flown from that base, there was little chance of finding any trace 
of sarin or its degradation products at an airbase of that size (approximately 10 km 2 ) 
without specific information as to where to collect samples. 
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26. During a briefing given by the Syrian Arab Republic to the Mechanism in 
Damascus, a representative of the Syrian Arab Air Force stated that no aircraft of 
the Air Force had attacked Khan Shaykhun on 4 April 2017. This contradicted the 
public statement made by the Government of the Syrian Arab Republic (see para. 5 
above). The Mechanism also interviewed the Commander of Sha‘irat airbase, who 
stated that no aircraft from the airbase had attacked Khan Shaykhun on 4 April. 

27. At the request of the Mechanism, the Syrian Arab Republic provided the exact 
coordinates of six locations targeted by the Syrian Arab Air Force aircraft operating 
from Sha‘irat airbase on 4 April 2017. The coordinates were found to be similar to 
the description of the targets identified in the relevant logbook. While those entries 
include flight times that correspond to the likely timing of the sarin event at Khan 
Shaykhun, they refer to aerial attacks targeting unidentified non-State armed groups 
in the town of Tall Hawash and west of Kafr Zayta. As noted above, while the 
Mechanism could confirm that one of these locations had sustained damage, it could 
not confirm that the damage had occurred on 4 April. 

28. On 7 April 2017, United States authorities publicly released a statement and a 
map depicting a flight path of an aircraft originating from Sha‘irat airbase that 
allegedly had been flying over Khan Shaykhun at approximately 0637 and 
0646 hours. The Mechanism had access to another aerial map depicting the path of 
an aircraft alleged to have been in the airspace around Khan Shaykhun between 
approximately 0644 and 0651 hours on 4 April 2017. The aircraft was depicted as 
flying in a circular loop pattern in the vicinity of Kafr Zayta and north-east of Khan 
Shaykhun. The map indicated that the closest to Khan Shaykhun that the aircraft had 
flown had been approximately 5 km away. Additional information provided to the 
Mechanism referred to two aircraft that had taken off from Sha‘irat airbase at 
around the same time as indicated above, 10 minutes apart, following the same 
flight path. On the basis of the above, the Mechanism found that air activity had 
taken place around Khan Shaykhun at about the time of the sarin incident. 

29. The Mechanism compared the flight times of Syrian Arab Air Force aircraft 
taking off from Sha‘irat airbase, as provided by the Government of the Syrian Arab 
Republic, with other flight information that it had received. The Syrian and other 
accounts are consistent in indicating that the Syrian Arab Air Force aircraft were in 
the air at the relevant time. Where the accounts diverge is with respect to whether or 
not the aircraft flew over or in the immediate vicinity of Khan Shaykhun. 

30. As noted in paragraphs 19, 23 and 28 above, the Mechanism obtained 
information detailing the presence of a Su-22 within 5 km of Khan Shaykhun, as 
well as information provided by a Su-22 pilot interviewed by the Mechanism 
indicating that he had been within 7 to 9 km of Khan Shaykhun at the relevant time. 
The Mechanism consulted with a weapons expert to ascertain the confluence of 
distance and altitude from which it might be possible to hit Khan Shaykhun with an 
aerial bomb. The expert concluded that, depending on a number of variables such as 
altitude, speed and the flight path taken, it would be possible for such an aerial 
bomb to be dropped on the town from the aforementioned distances. 

31. To date, the Mechanism has found no specific information confirming whether 
or not a Syrian Arab Air Force Su-22 operating from Sha‘irat airbase launched an 
aerial attack against Khan Shaykhun on 4 April 2017. 

Ground explosion 

32. The Mechanism also sought to collect information about possible activities 
related to the dissemination of sarin from an improvised explosive device on the 
ground in accordance with the second scenario. While the Mechanism found no 
information relating to the preparation of an explosion through such means, it noted 


24/33 


17-18978 



S/2017/904 


a witness statement that was consistent with that scenario. In an interview with the 
Mechanism, the witness reported waking up at approximately 0700 hours on 4 April 
2017 to the sound of explosions. The witness stated that no aircraft had been flying 
over Khan Shaykhun at the time and that aircraft had begun to launch attacks only at 
around 1100 hours. 

33. No witnesses reported any activities related to the placing of an explosive 
charge on the ground at the location of the incident. 

34. The Syrian Arab Republic provided information to the Mechanism suggesting 
that the release of sarin had been associated with an above-ground explosion, using 
an explosive charge that did not exceed 10 kg and that had been placed on the 
ground with a 25-litre container full of sarin. This is examined in further detail in 
the sections below. 

Bombing of a house taken over by a non-State armed group 

35. In connection with the third scenario, witness statements refer to reports of a 
house in Khan Shaykhun being taken over by a non-State armed group and used 
thereafter for the storage of ammunition and barrels. The Mechanism identified the 
location of the house, which corresponded to the second plume shown in the video 
filmed between 0642 and 0652 hours that morning. Analysis of satellite imagery 
revealed that damage caused to the roof of the house had occurred between 
21 February and 6 April 2017. Original photographs provided by witnesses 
interviewed by the Mechanism also showed damage to the roof and front of the 
house. An independent expert engaged by the Mechanism found that the damage to 
the house was consistent with an explosion being caused by an air-delivered 
thermobaric bomb or fuel-air explosives. Samples taken by the Syrian Arab 
Republic from the site of the house at a later date were not found to contain traces 
of sarin or its degradation products. 

36. The Mechanism has found no information indicating that sarin was released 
from this location on the morning of 4 April 2017. The Mechanism found no other 
information related to that scenario. 

Bombing of a warehouse on the eastern outskirts of Khan Shaykhun 

37. The Mechanism also conducted investigations with respect to the possibility 
that sarin may have been released following the bombing of a building on the 
eastern outskirts of Khan Shaykhun at around noon on 4 April 2017. The location, 
referred to in some public statements as a terrorist ammunition depot, appears to be 
a building used by the Syria Civil Defence as a medical site on the eastern outskirts 
of Khan Shaykhun. Apart from the fact that victims of the sarin incident earlier that 
morning had been treated there, the Mechanism did not link that location to the 
release of sarin. 

Impact location 

38. In accordance with the first two scenarios investigated by the Mechanism, the 
crater is the point of impact of either of the following: (a) an aerial bomb dropped 
from an airplane, thus dispersing sarin; or (b) an undefined mechanism, linked to 
the dispersion of sarin, that exploded on the surface of the road. 

39. The impact location was determined to be the site identified by the Fact- 
Finding Mission as being to the west of grain silos in the northern part of Khan 
Shaykhun. Samples taken from the crater and its surroundings were found by the 
Fact-Finding Mission to contain sarin. 
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40. The Mechanism collected multiple photographs and videos of the crater from 
witnesses and open sources, as well as satellite imagery from a provider contracted 
by the Mechanism. Using those materials, forensic institutes engaged by the 
Mechanism determined that the crater is located at approximately 35°26'59.75"N, 
36°38'55.91"E. 

41. In order to identify other points of impact possibly associated with the release 
of sarin, the Mechanism commissioned the forensic analysis of video footage taken 
between 0642 and 0652 hours on 4 April that showed four plumes across Khan 
Shaykhun, three of which had been located approximately 320 m south-west of the 
crater and the fourth approximately 1.3 km south-south-west of the crater, one of 
which had been shorter and whiter than the others. None of the locations from 
which the plumes had emanated could be associated with the location of the crater. 

42. Expert analysis of satellite imagery available to the Mechanism that had been 
taken of Khan Shaykhun on 21 February 2017 and 6 April 2017 was carried out to 
identify signs of damaged structures and craters in the area correlating to the 
locations of the plumes. The Mechanism found that at least three of those locations 
were buildings that appeared to have been damaged by a thermobaric bomb or fuel- 
air explosives. Damage to a building was observed in the general vicinity of the 
shorter plume, which appeared to have been created between the aforementioned 
dates. Therefore, the Mechanism could not conclusively determine that the building 
had been bombed on 4 April 2017. 

43. The cause of the plume that was shorter and whiter in appearance than the 
other three could not be conclusively identified by munitions experts engaged by the 
Mechanism. Two experts noted that the plume had probably consisted of aerosolized 
droplets of liquid. One explained that the plume’s appearance might indicate the use 
of a vacuum bomb that had possibly failed to explode, with the plume being a cloud 
of explosive liquid that had disseminated from the munition. 

44. Although the plumes cannot be associated with the crater, they indicate that an 
aerial attack occurred in Khan Shaykhun on the morning of 4 April 2017. 

Crater analysis 

45. As the site where the sarin was released on the morning of 4 April 2017 was of 
particular importance to the investigation, the Mechanism undertook extensive 
efforts to collect photographs and videos of the location and to obtain expert 
analysis of its characteristics from several independent sources. 

46. Original video footage and photographs of the impact location taken early in 
the morning on 4 April 2017 by a witness interviewed by the Mechanism, which 
were determined by a forensic institute to have been recorded between 0804 and 
0917 hours, showed the crater and a deformed piece of metal protruding from it. 
The crater was estimated by forensic experts to have a diameter of approximately 
1.5 to 1.65 m and a depth of between 42 and 51 cm. The videos and photographs 
showed the crater to contain debris of rock and asphalt, fragments of metal and a 
circular metal object that appeared to be a munition filler cap. Remnants of green 
paint were observed on both the deformed piece of metal and the filler cap. 

47. The Government of the Syrian Arab Republic provided the Mechanism with a 
report setting forth a series of observations about the crater. In the report, the 
Government concluded that the shape and characteristics of the crater and the lack 
of physical evidence did not indicate that it had been the result of an air strike. It 
was noted that the shape, depth and contents of the crater were not consistent with 
the effects of an aerial bomb, but rather indicated that it had been the result of a 
ground explosion produced using a device weighing no more than 10 kg. In support 
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of its position, the Government referred to the incompleteness of the debris of the 
alleged explosion and the absence of any residues of the bomb or rocket, including a 
rocket motor, tail or fins. It was also stated that three pieces from an unknown 
source had been deliberately placed, including the remnants of an alleged shell. The 
Government stated that that confirmed that the scene had been fabricated to suggest 
that the crater had resulted from the explosion of an aerial bomb. It was also noted 
in the report that the crater and its surroundings had contained traces of live agent 
(sarin) and its degradation products, which had been found 10 days after the alleged 
attack, indicating that the explosion had not led to the dispersion of the full contents 
of the sarin container, and that the explosion had not been well calculated. 

48. The Mechanism obtained expert analysis of the characteristics of the crater 
from three independent, internationally recognized institutes with specialization in 
the areas of forensics, defence and security, as well as by two individual 
independent experts in energetic materials. 

49. A defence research institute with expertise in high explosives and related 
materials noted that the site appeared to have been disturbed after impact. 
Nevertheless, it found indications that the ground had been hit by a substantially 
heavy object that had travelled at high velocity. While it could not rule out the idea 
that the crater had been caused by other means, it stated that indications of the 
detonation of a high explosive on the ground were not visible. 

50. Another specialist forensic institute examined photographs and videos of the 
crater. In considering what had caused the crater, the institute stated that the damage 
was consistent with that of an impact from an unguided aerial bomb, possibly 
containing a small bursting charge. It explained that that conclusion was based on 
the evidence showing that there had been very little damage around the crater 
caused by fragmentation of the munition casing and no significant damage to 
structures near the crater due to blast overpressure. The institute also observed that 
the use of a ground-launched munition was unlikely, as no remnants peculiar to a 
rocket had been evident in the crater or found in its vicinity. 

51. One of the individual experts noted that the impact location was a section of 
paved road very close to which a metal cabinet was situated. As no significant 
impacts or holes were visible in the plates of the metal cabinet, the impact was 
consistent with that of a liquid-filled bomb that had a thin shell and contained a very 
limited amount of explosive in its bursting charge. The expert found that the 
appearance of the crater indicated that the pavement had been hit by a relatively 
large object at high velocity, without a large amount of explosives being involved. 

52. With regard to the suggestion that the crater might have been caused by an 
explosive charge placed on the ground, the expert noted that that was contradicted 
by the following: (a) the appearance of the edges of the surrounding pavement, 
where little fragmentation was seen; (b) the absence of an elevated rim around the 
crater; (c) the relatively few cracks in the pavement around the crater; and (d) the 
existence of objects buried deep in the crater. The expert also dismissed the 
suggestion that the crater might have been created by excavation and the 
emplacement of the objects found therein, on account of the following: (a) the 
jagged appearance of the edges; (b) the radial cracks formed in the pavement; 
(c) the depth at which the objects were buried in the crater; and (d) the lack of any 
sign of the tools used to excavate the crater, which would have left marks on its 
edges. The expert concluded that it was very unlikely that the crater had been 
caused by a ground-launched weapon, an explosive charge or a liquid-filled 
warhead emplaced on the ground, or excavation and the emplacement of the objects 
found therein. 
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53. The expert examined the dimensions and shape of the crater and analysed 
whether it was consistent with the use of various types of bombs and rockets. The 
expert concluded that the type of munition most likely to have caused the crater was 
a relatively large bomb with a mass of 300 to 450 kg. The shape of the crater, which 
was relatively circular, indicated that the bomb had been dropped from a medium or 
high altitude, of between approximately 4,000 and 10,000 m. 

54. The experts agreed that the crater was unlikely to have been caused by high 
explosives, as there were too few visible signs of damage caused by fragmentation 
or overpressure, especially on the metal cabinet located 3 to 5 m away from the 
crater. The expert analysis found that the characteristics of the crater were consistent 
with the impact of a heavy object travelling at high velocity, probably with a liquid 
fill. Any explosion from the bursting charge would be small and, furthermore, the 
liquid surrounding the bursting charge would have absorbed most of the energy 
from the explosion. The Mechanism notes that, on the basis of the foregoing, the 
characteristics of the crater are more likely to have been caused by an aerial bomb 
with a small explosive charge, and that it probably contained liquid. 

Munition analysis 

55. As described in paragraph 46 above, two objects of interest that were visible in 
photographs and videos of the crater were analysed by the Mechanism. These were 
the filler cap from a chemical munition and a deformed piece of metal protruding 
from deep within the crater. 

56. According to information obtained by the Mechanism, the filler cap, with two 
closure plugs, is uniquely consistent with Syrian chemical aerial bombs. The 
Mechanism was provided with an assessment of the filler cap and with chemical 
analysis showing sarin and a reaction product of sarin with hexamine that can be 
formed only under very high heat. Information was also received that additional 
metal fragments collected from the crater might correspond to parts of Syrian aerial 
chemical munitions. 

57. The two energetic-materials experts engaged by the Mechanism reported that 
the size and thickness of the metal piece protruding from the crater indicated that it 
had been the casing of an aerial bomb measuring between 300 and 500 mm in 
diameter. 

58. The munition remnants recovered from the crater by unidentified individuals 
are assessed as being associated with an air-delivered chemical bomb. Specific 
munition remnants, particularly the tailfin, could not be recovered. The absence of a 
chain of custody relating to the munition remnants diminishes their probative value. 

59. The Syrian Arab Republic provided information to the Mechanism suggesting 
that the release of sarin had been associated with an above-ground explosion, which 
is reflected in the second scenario examined by the Mechanism. According to the 
government report, the point of impact had been the result of a ground explosion 
using an explosive charge that did not exceed 10 kg of trinitrotoluene (TNT) and 
that had been placed on the ground with a 25-litre container full of sarin. The 
Government also noted that the fact that the crater and its surroundings had 
contained traces of sarin and its degradation products 10 days after the incident 
proved that the explosion had not dispersed all the sarin in the container, which 
meant that the explosion had not been well calculated. 

60. The Mechanism also requested the two individual experts, forensic institutes 
and defence institutes to examine whether an explosive device placed on the ground 
could have caused the crater. The forensic institutes and the experts in energetic 
materials ruled out the idea that an improvised explosive device placed underground 
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would have created such a crater. This was based on the characteristics of the crater 
and the lack of substantial cracks and radial detonation marks of blast products on 
the surface surrounding it. 

61. With respect to whether such a device might have been placed on the surface 
of the road, they determined that it would have needed to contain an equivalent of 
10 kg of TNT or 12 kg of ammonium nitrate fuel oil. The experts generally ruled out 
that possibility, because such an explosion would have caused much more damage 
to the surroundings than what had been observed. The two experts in energetic 
materials also noted that the metal object protruding from the crater was too large 
and too deeply embedded for the improvised explosive device scenario to be likely. 

62. Further to the statements of witnesses that they saw and heard aircraft, the 
observations with potentially the most probative value, namely, those of the forensic 
institutes and individual experts, indicate that the crater was most likely caused by 
an unguided air-delivered bomb. 

63. On the basis of the lack of characteristics that would be expected following an 
explosion produced by an explosive charge placed on the ground, the Mechanism 
notes that the munition used would more likely have been an aerial bomb. 

Dispersion of sarin 

64. Sarin of an undefined purity was disseminated from the crater in a direction 
that was defined by local air movements. The Mechanism noted that the wind speed 
in the area that day had been <0.5 m/s, which would normally result in a 
considerable variation in the direction of the air movement. The Mechanism also 
noted that the location of victims, as described in the report of the Fact-Finding 
Mission, serves as an indicator of prevailing air movements west to south-west of 
the location of the crater during the early morning on 4 April 2017. 

65. A defence research institute with expertise in dispersion modelling was 
commissioned by the Mechanism to determine the likely amount of sarin released 
and its impact on the number of victims poisoned. In conducting the modelling, the 
defence research institute took into account certain factors specific to Khan 
Shaykhun, such as its population and local weather conditions. 

66. While no firm conclusion as to the amount of sarin used in Khan Shaykhun on 
4 April 2017 could be established, the institute noted that, if the same quantity of 
sarin were used, an aerial bomb would be expected to deposit smaller amounts of 
sarin on the ground than an explosive charge placed directly on the ground. 

67. The observation made by the Syrian Arabic Republic that traces of live agent 
(sarin) could be observed, 10 days after the incident, in the crater area and the area 
near the silos 80 m to the east of the crater may be explained by the amount of sarin 
deposited on the ground at the time of its release. The Mechanism therefore 
compared the amounts of sarin that would be deposited on the ground by the 
following: (a) a chemical aerial bomb; and (b) an improvised explosive device for 
dispersion. A chemical aerial bomb releasing 150 to 250 litres of sarin and 
depositing 10 to 15 per cent of its contents on the ground would deposit more sarin 
on the ground than an improvised explosive device containing 25 litres of sarin. The 
Mechanism notes that, in either case, sarin would have been dispersed into the 
general environment, as has been confirmed by the analysis of environmental 
samples. 

68. The above analysis supports the scenario of an aerial bomb depositing a larger 
amount of sarin on or into the ground than would be deposited by an improvised 
explosive device containing 25 litres of sarin. 
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Medical effects and response 

69. While noting the findings of the Fact-Finding Mission, the Mechanism 
collected and reviewed information from a range of sources concerning the medical 
effects on and treatment administered to persons in Khan Shaykhun following the 
incident, including open sources, interviews with victims and medical personnel, 
and a review of medical records. The Mechanism collected and analysed that 
information to determine the impact of the incident on the community, in particular 
its emergency response and health-care sector. 

70. In reports from open sources in the immediate aftermath of the incident, it was 
noted that victims in Khan Shaykhun appeared to show symptoms consistent with 
exposure to organophosphorus chemicals also expressed as a neurotoxic agent. In 
addition, open sources reported that chlorine might also have been released, as 
indicated by the smell of bleach. While the Mechanism could not rule out the 
possibility of the use of chlorine, it focused its investigative efforts on the use of 
sarin. 

71. On the basis of medical records and witness statements, the Fact-Finding 
Mission identified approximately 100 fatalities and at least 200 other casualties who 
had survived acute exposure. Such an event in a town the size of Khan Shaykhun 
would constitute quite a challenge for a society already in distress. There are four 
critical immediate recourses that should be available in a mass-casualty incident 
involving sarin poisoning: (a) adequate decontamination to stop exposure and 
protect rescue and health-care staff from secondary contamination; (b) assisted 
ventilation, either mechanical or manual, after intubation; (c) sufficient 
administration of the primary antidotes atropine and pralidoxime; and (d) ample 
capacity for the transport of patients so that their needs can be met. 

72. The Mechanism ascertained that more than 10 health-care facilities in Khan 
Shaykhun, Idlib Governorate and a neighbouring country had become involved in 
providing health care to those affected by the incident. According to reports, doctors 
were struggling amid extreme shortages, including of the antidotes used to save 
patients. There were also reports that most of the fatalities had died before they had 
reached the hospitals. 

73. The Mechanism found that the reported symptoms of the victims were 
consistent with exposure to sarin and that the available information on the medical 
impact of the attack on 4 April 2017, including the response of the health-care 
sector, consistently pointed to the use of sarin. 

74. On the basis of its review of open-source material showing first responders in 
the hours immediately after the incident, the Mechanism observed several methods 
and procedures that appeared to be either unusual or inappropriate in the 
circumstances. In particular, the Mechanism noted that fully equipped hazmat teams 
had appeared at the scene later that afternoon and reported early detection of the 
presence of sarin, apparently using a Drager X-am 7000 ambient air monitor, which 
was not known to be able to detect sarin. Of additional concern to the Mechanism 
was the relatively unprofessional manner in which certain environmental samples 
appear to have been taken, for example, sampling from a muddy puddle. 

75. The Mechanism also noted scenes recorded just after the incident at the 
medical site to the east of Khan Shaykhun, where rescue and decontamination 
activities filmed shortly after 0700 hours showed rescue personnel indiscriminately 
hosing down patients with water for extended periods of time. That video footage 
also showed a number of patients not being attended to, as well as paramedical 
interventions that did not seem to make medical sense, such as performing cardiac 
compression on a patient who was lying face down. 
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76. The Mechanism was provided with expert analysis regarding the medical 
symptoms and responses indicated in witness statements and medical records, as 
well as the treatment received at a range of health-care facilities, including those in 
a neighbouring country. 

77. Certain irregularities were observed in elements of the information analysed. 
For example, several hospitals appeared to have begun admitting casualties of the 
attack between 0640 and 0645 hours. The Mechanism received the medical records 
of 247 patients from Khan Shaykhun who had been admitted to various health-care 
facilities, including survivors and a number of victims who eventually died from 
exposure to a chemical agent. The admission times noted in the records range from 
0600 to 1600 hours. Analysis of the records revealed that in 57 cases, patients had 
been admitted to five hospitals before the incident (at 0600, 0620 and 0640 hours). 
In 10 of those cases, patients appear to have been admitted to a hospital 125 km 
away from Khan Shaykhun at 0700 hours, while another 42 patients appear to have 
been admitted to a hospital 30 km away at 0700 hours. The Mechanism did not 
investigate those discrepancies and cannot determine whether they are linked to any 
possible staging scenario or are the result of poor record-keeping in chaotic 
conditions. 

78. An inconsistency was identified in one of the Fact-Finding Mission’s 
biomedical results from samples lacking a chain of custody. In sample No. 13, 1 the 
blood sample tested negative for sarin or a sarin-like substance, while the urine 
sample tested positive for the sarin degradation product isopropyl 
methylphosphonate. There is currently no explanation for the inconsistency. 
Medical experts consulted by the Mechanism indicated that the combination of the 
negative result in the blood and the positive result in the urine was impossible. That 
inconsistency was considered to he most likely the result of cross-contamination in 
the sampling process. 

79. The Mechanism observed from open sources that the treatment administered to 
victims from Khan Shaykhun had frequently involved oxygen and cortisone therapy. 
Such treatment is not recommended for sarin poisoning, but is recommended mainly 
for lung damage, as would be caused by either chlorine or vacuum bombs. 

80. On the basis of its consultations with two medical experts, the Mechanism 
found that the response carried out by rescue workers and medical personnel in 
Khan Shaykhun on 4 April 2017 had been essentially consistent with the use of 
sarin on such a scale. While some potentially important irregularities were identified 
throughout the rescue operation and in medical records, they may he explained by 
such factors as poor training, the chaotic conditions or attempts to inflate the gravity 
of the situation for depiction in the media. 

Chemistry 

81. In order to ascertain the origin of the sarin dispersed in Khan Shaykhun, the 
Mechanism took steps to identify its components and its possible production 
methods, including by commissioning studies at an OPCW-designated laboratory. 

82. In the course of synthesizing a chemical, not only the desired chemical, but 
also certain by-products, are formed. If the production of a chemical requires 
several reaction steps, such by-products are also carried forward as impurities to the 
next step of the synthesis. Furthermore, impurities may undergo chemical 
transformation themselves, thus forming new and different impurities. Therefore, 
the method used for the production of a chemical may be ascertained by identifying 
the impurities that it contains. Impurities in samples may also link a sample to its 
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starting material (precursor) should the impurities in the sample and the precursor 
match. 

83. During the removal of the stockpile belonging to the Syrian Arab Republic in 
2014, OPCW collected samples from the sarin precursor methylphosphonyl 
difluoride (DF) before the rest of the stockpile was destroyed. The Mechanism 
commissioned a laboratory to study and compare the impurities, and their 
formation, in samples of stockpiled DF. Five different samples from the country’s 
DF stockpile were analysed for impurities. 

84. Environmental samples were collected in Khan Shaykhun both from inside the 
crater and from its surroundings. The results of the analysis carried out by OPCW - 
designated laboratories confirm the presence of sarin and some of its known 
degradation products. 2 Moreover, the results confirm that sarin was produced by the 
binary route, in which DF is combined with isopropanol (iPrOH) in the presence of 
hexamine. 

85. The five DF samples from the Syrian Arab Republic stockpile and the 
environmental samples from Khan Shaykhun all contained the impurity phosphorus 
hexafluoride (PF6). The Mechanism studied the significance of PF6 as a “marker 
chemical” for DF produced by the Syrian Arab Republic. The study tested the 
conditions for the formation of PF6 in the production of DF, as well as the 
possibility of its removal from DF. Laboratory experiments showed that PF6 is 
formed when hydrogen fluoride (HF) is used as a fluorinating agent in the 
production of DF. If a different commonly used fluorinating agent is used, no PF6 is 
formed. PF6 is also not formed in such DF as a result of long-term storage. 
Furthermore, the test showed that PF6 cannot be removed through distillation. 

86. Two of the five samples from the Syrian Arab Republic DF stockpile contained 
the impurity phosphorous oxychloride (POC13). The environmental samples from 
Khan Shaykhun had two additional types of marker chemicals: isopropyl phosphates 
and isopropyl phosphorofluoridates. Laboratory tests show that such marker 
chemicals are formed if DF from the Syrian Arab Republic stockpile containing 
POC13 is used to make binary sarin. 

87. On the basis of the foregoing, the Mechanism concludes that the presence of 
the marker chemical PF6 is evidence that HF was used to produce the DF that was 
the precursor for the sarin released in Khan Shaykhun. HF is a very aggressive and 
dangerous gas and therefore is difficult to handle. The use of HF indicates a high 
degree of competence and sophistication in the production of DF and points to a 
chemical-plant-type production method. 

88. The samples from Khan Shaykhun contain the three types of marker chemicals 
described above: PF6, isopropyl phosphates and isopropyl phosphorofluoridates. 
Their presence is a strong indicator that the sarin disseminated in Khan Shaykhun 
was produced from DF from the Syrian Arab Republic stockpile. 

89. An initial screening of the reports concerning previous incidents of the release 
of sarin in the Syrian Arab Republic showed that some marker chemicals appeared 
to be present in environmental samples. This would warrant further study. 

90. The presence of marker chemicals that are believed to he unique is a strong 
indication that the sarin released in Khan Shaykhun, as well as in previous 
incidents, was produced using DF from the Syrian Arab Republic stockpile. 

91. In the light of the marker chemicals identified in the DF and the sarin, which 
are believed to be unique, the Mechanism concludes that the precursor chemical DF, 


See S/2017/756, S/2017/567 and S/2017/440. 
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which is necessary for the production of binary sarin, is very likely to have 
originated from the Syrian Arab Republic. This finding relates only to the origin of 
the DF used as a precursor, not to those responsible for the dissemination of sarin. 

III. Assessment and findings by the Leadership Panel 

92. In order to determine to the greatest extent feasible those who were 
perpetrators, organizers, sponsors or otherwise involved in the use of sarin at Khan 
Shaykhun on 4 April 2017, the Leadership Panel requested that the investigators 
examine eight possible scenarios regarding how the events had unfolded. Upon the 
conclusion of the investigation, the prevailing scenario that emerged was that sarin 
had been delivered through an aerial bomb dropped by an airplane. Most of the 
information collected and analysed by the Mechanism supports that scenario. 

93. With respect to identifying those responsible, the Leadership Panel has 
determined that the information that it has obtained constitutes sufficient credible 
and reliable evidence of the following: 

(a) Aircraft dropped munitions over Khan Shaykhun between 0630 and 0700 
hours on 4 April 2017; 

(b) An aircraft of the Syrian Arab Republic was in the immediate vicinity of 
Khan Shaykhun between 0630 and 0700 hours on 4 April 2017; 

(c) The crater from which the sarin emanated was created on the morning of 
4 April 2017; 

(d) The crater was caused by the impact of an aerial bomb travelling at high 
velocity; 

(e) A large number of people were affected by sarin between 0630 and 0700 
hours on the morning of 4 April 2017; 

(f) The number of persons affected by the release of sarin on 4 April 2017, 
and the fact that sarin reportedly continued to be present at the site of the crater 
10 days after the incident, indicate that a large amount of sarin was likely released, 
which is consistent with its being dispersed through a chemical aerial bomb; 

(g) The symptoms of the victims and their medical treatment, as well as the 
scale of the incident, are consistent with large-scale sarin poisoning; 

(h) The sarin identified in the samples taken from Khan Shaykhun was found 
to have most likely been made with a precursor (DF) from the original stockpile of 
the Syrian Arab Republic; 

(i) The irregularities described in the present annex are not of such a nature 
as to call into question the aforementioned findings. 

On the basis of the foregoing, the Leadership Panel is confident that the Syrian Arab 
Republic is responsible for the release of sarin at Khan Shaykhun on 4 April 2017. 
The findings of the Leadership Panel regarding the evidence in this case are based 
on the information set forth in detail in the present annex. 
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